EP0768773B1 - Method of establishing a common key for authorised users by means of a threshold scheme - Google Patents

Abstract

The method is operated at an exchange which is connected to a number of subscribers by insecure (especially radio) channels. A "shadow" is derived from the personal key of each authorised subscriber, and a key is constructed from the totality of such "shadows". Data for construction of the key are transmitted so that each authorised subscriber can derive the common key from his or her personal key, by computation from the associated "shadow" with the aid of the others.

Description

The invention relates to a method in the preamble of Claim 1 more precisely defined type Process is by C.-S. LAIH & S.-M. YEN in "On the Design of Conference Key Distribution Systems for the Broadcasting Networks ".

Encryption methods in various ways are part of the State of the art and increasingly gain commercial Meaning. They have been used recently to Broadcast media messages to send, but only the owner of a crypto key can read these messages in plain text.

For such an application, symmetrical designs are often used Encryption algorithms used (for the definition a symmetric encryption algorithm see also A. Beutelspacher: Kryptologie, Vieweg Verlag 1994).

An application of this type is briefly explained below using an example:
Messages from a central station Z are to authorized persons, which are hereinafter referred to as P _1, ..., P _n, where n ≤ m holds and P is the total number of persons through a broadcasting medium (terrestrial broadcasting, satellite, cable), or other unsecured channels are sent.

Each person P _i from P is assigned a personal key k _i that only the person himself and the central office Z know. The control center Z now selects the key k and encrypts it for i = 1, ..., N with the respective personal key k _i : C. i = E (k i, k).

This cryptogram is then sent to the selected authorized person P _i , who can calculate the key k by decrypting the cryptogram: D (k i, C. i ) = D (k i , E (k i, k)) = k.

This method is used e.g. B. in the Pay TV system Eurocrypt (DIN EN 50 094) is used to establish a system key.

The disadvantage of this method is that the key k is transmitted encrypted . In many countries, the use of an encryption algorithm is subject to legal reservations. This could e.g. B. lead to the fact that the algorithm E used above (for English "encryption") must be very weak.

• jede Person P_i des vorgegebenen Personenkreises P einen persönlichen Schlüssel k_i besitzt, der nur dieser Person P_i und der Zentrale Z bekannt ist,
• in der Zentrale unter Verwendung eines gemeinsamen Parameters r und einer Einwegfunktion f() für jede der n autorisierten Personen aus dem persönlichen Schlüssel k_i ein nachfolgend als shadow s_i bezeichnetes Teilgeheimnis abgeleitet wird,
• danach in der zentralen Instanz aus den shadows aller autorisierten Personen ein (n,t)-Threshold-Verfahren mit t≥2n-1 konstruiert und aus den shadows s₁ ....s_n ein Schlüssel k berechnet wird,
• danach die Daten zur Konstruktion von k über den ungesicherten Kanal übertragen werden,
• die es letztlich den empfangenden autorisierten Personen P_1, ..., P_n ermöglichen, aus ihrem persönlichen Schlüssel k_i den ihnen zugeordneten shadow s_i abzuleiten und daraus mit Hilfe der mit übertragenden n-1 weiteren shadows sowie dem (n,t)-Threshold-Verfahrens den Krypto-Schlüssel k zu berechnen.

The mentioned method closest to the invention is that of C.-S. LAIH u. S.-M. Yen in "On the Design of Conference Key Distribution Systems for the Broadcasting Networks". It is used in the computer network to establish shared secret information k as a key for authorized persons from a larger group of people and is assigned by a "chairman" as the central instance or center. This central Z decides which people from a group of people are authorized. The process guarantees that only these people can receive or calculate the key and uses the steps that

• each person P _{i of} the specified group of people P has a personal key k _i that is known only to this person P _i and the central office Z,
• in the control center, using a common parameter r and a one-way function f () for each of the n authorized persons, a partial secret, hereinafter referred to as shadow s _i, is derived from the personal key k _i ,
• then an (n, t) threshold method with t≥2n-1 is constructed from the shadows of all authorized persons in the central instance and a key k is calculated from the shadows s ₁ .... s _n ,
• then the construction data of k is transmitted over the unsecured channel,
• which ultimately enable the receiving authorized persons P _1, ..., P _n to derive the shadow s _i assigned to them from their personal key k _{i and} to use them to transfer further shadows and the (n, t) -Threshold procedure to calculate the crypto key k.

This process is for the network of powerful computers provided and therefore does not take into account that the Computing power of the widely used additional devices for the receiving devices is much lower. Because the crowd of the authorized persons changes over time Attendance is a total of participants who are interested on the other hand, the calculation must change for each shipment fast and yet sufficient against possible attacks be sure.

The invention has for its object to provide a method that requires less computing power and is still sufficiently safe.

This task is carried out in the characterizing part of the claim 1 described procedural steps solved.

With the reduced demands on computer performance the field of application of this very safe expands Procedure also applies to the areas of daily life, for which increasingly demands cryptological security is, but for economic reasons the computing power must be minimal, for example decoders for pay TV, T-Online for closed user groups, etc.

With regard to additional cryptological security advantageous developments in the characteristics of the subclaims 2 and 3 listed.

The basic principle from which the invention follows Embodiments is described in more detail, is to be seen in it using methods of symmetric cryptography the functionality of that described in DIN EN 50 094 To reproduce the process without encryption to use. Here, a combination of key-operated one-way function with a threshold procedure (A. Shamir: How to Share a Secret. Comm. ACM, Vol. 24, No. 11, 1979, 118-119). Thereby can comply with legal security of the key distribution mechanism can be improved.

A one-way function (see Beutelspacher, see above) is one Function g (·), which is easy to evaluate (i.e. for any value a is g (a) easily computable), but for which it is practically impossible to enter a given image value b To find archetype a, so that g (a) = b holds. A key operated One-way function is a one-way function f () with two arguments k and a, where the value k is considered the key can be.

With an (n, t) threshold method one can break down a secret k into t parts called shadows in such a way that this secret can be reconstructed from each of the t shadows.

As an example of such a (n, t) threshold method, a polynomial of degree n-1 is to be used below, from which t = 2n-l nodes are selected as shadows.
By specifying n interpolation points, ie n pairs (x _i, y _i ) (i = l, ..., n) of elements of a body with different x components, a unique polynomial of degree nl is defined. This polynomial intersects the y-axis at a clearly defined point.

1. (a_i, b_i):= (i, k_i),

2. (a_i,b_i):= (l, g(k_i)) für eine Einwegfunktion g(·),

3. (a_i,b_i):=(i, f(r, k_i)) für eine schlüsselgesteuerte Einwegfunktion f() und eine Zufallszahl r,

4. (a_i,b_i):=(f(r, l_i), f(r, l_i')) für eine schlüsselgesteuerte Einwegfunktion f(), eine Zufallszahl r und k_i=(l_i, l_i'),

usw.In order to establish a common key for authorized persons P _l, ..., P _n , a support point (a _i , b _i ) is first assigned to each person P _i from P using the personal key k _i . This can be done in several ways:

1. (a _i , b _i ): = (i, k _i ),

2. (a _i , b _i ): = (l, g (k _i )) for a one-way function g (·),

3. (a _i , b _i ): = (i, f (r, k _i )) for a key-controlled one-way function f () and a random number r,

4. (a _i , b _i ): = (f (r, l _i ), f (r, l _i ')) for a key-controlled one-way function f (), a random number r and k _i = (l _i , l _i '),

etc.

The poles (a ₁ , b ₁ ), ..., (a _n , b _n ) define a polynomial p (x) of degree n-1. The clear intersection k: = p (0) this polynomial with the y-axis is the common key for P ₁ , ..., P _n . So that the authorized persons P _l , ..., P _n can calculate this value k, the control center nl selects further support points (c _l , d _l ), ..., (c _nl , d _nl ), which are determined by (a ₁ , b ₁ ), ..., (a _n , b _n ) must be different. These can be sent to all persons from P together with the additional information required to calculate the support points (e.g. the random number r from 3rd).

Only the selected people P _i (l≤i≤n) can now calculate the key k. For this purpose, the selected person P _i adds the support point (a _i , b _i ) to the set (c _l , d _l ), ..., (c _nl , d _nl ), which only he and the control center can calculate, since only he and the control center know the personal key k _i . The n support points thus obtained uniquely determine the polynomial p (x) and thus also the number k = p (0).

The unauthorized persons P _i (n + l ≤ i ≤ m) cannot calculate the key k, because the support points (a _i , b _i ) that they can calculate are not on the graph of p (x).

According to the invention specified in claim 1 a key-controlled to derive the support points One-way function, i.e. a variant of the procedure (3.) or Use (4.) to rule out possible attacks that possible when using the weaker variants (1.) and (2.) would be. In this case it can be clearly shown that an unauthorized attacker is one after this Method established key k could only break if he could reverse the one-way function.

Claims (3)

1. Method for establishing a common key k for authorized persons by means of a threshold procedure, through a central office Z, over unsecured channels, particularly a broadcasting medium, with the following steps:

   Each person P_i of the given group of persons P possesses a personal key k_i which is only known to that person P_i and to a central office Z;

   at the central office Z, a partial secret, in the following designated as shadow s_i, is derived for each of the n authorized persons from their personal key k_i, using a common parameter r and a one-way function f();

   subsequently, an (n, t) threshold procedure with t ≥ 2n-1 is constructed from the shadows of all authorized persons, and a key k is calculated from the shadows s₁ ... s_n;

   then, the data for the construction of k are transmitted over the unsecured channel;

   finally, these data allow the receiving authorized persons P_i, ..., P_n to derive from their personal key k_i the shadow s_i assigned to them and - using the other n-1 shadows that were also transmitted as well as the (n, t) threshold procedure - to compute from this the crypto-key k, characterized in that at the central office Z, in order to distribute crypto-keys to a subset, varying over time, of a universal set of a given group of persons consisting of P participants, shadows si of the following types are derived from the personal k_i of each authorized person P_i:

   s_i = (i, f(r, k_i)) for a one-way function f ( ) and a random number r; or

   s_i = (f (r, 1_i), f(r, l_i')) for a one-way function f ( ), a random number r and k_i = (l_i, l_i').
2. A method in accordance with claim 1, characterized in that the (n, t) threshold procedure is carried out using a polynomial of degree n-1, which is uniquely defined by n interpolation nodes derived using the shadows and from which additional shadows are obtained at the central office by selecting points on the graph of the polynomial that are different from the interpolation nodes obtained from the shadows of the authorized participants.
3. A method in accordance with claim 1, characterized in that it is used for successively establishing a hierarchy of keys.